CVE-2026-12126: WCFM Marketplace Plugin XSS Vulnerability

CVE-2026-12126 Overview

CVE-2026-12126 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress. All versions up to and including 3.7.3 are affected. The plugin fails to sanitize input and escape output for the post_title field on media attachments. Authenticated attackers with Vendor-level access or higher can inject arbitrary JavaScript that executes when a privileged user opens the media dashboard. The payload is planted through the WordPress REST API endpoint /wp-json/wp/v2/media and later rendered as innerHTML inside DataTables JSON output.

Critical Impact
A Vendor-level account can achieve script execution in the browser session of any administrator or shop manager who loads the media dashboard, enabling session theft, privilege escalation, and marketplace-wide compromise.

Affected Products

WCFM Marketplace – Multivendor Marketplace for WooCommerce (WordPress plugin)
All versions up to and including 3.7.3
Vulnerable files: controllers/media/wcfmmp-controller-media.php and core/class-wcfmmp-media.php

Discovery Timeline

2026-07-11 - CVE-2026-12126 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12126

Vulnerability Analysis

The flaw resides in how the WCFM Marketplace plugin handles the post_title field of media attachments when rendering the vendor media dashboard. The plugin retrieves attachment titles directly from the database and emits them into a JSON response consumed by the DataTables JavaScript library on the admin side. Because the value is inserted into the DOM through innerHTML without HTML entity encoding, any JavaScript embedded in an attachment title executes in the context of the viewing user.

The attack does not require the attacker to invoke the plugin's AJAX endpoint directly. Instead, a vendor account with media upload permissions can seed the payload through the standard WordPress REST API media endpoint. The malicious title persists in wp_posts and fires whenever a privileged user (site administrator, shop manager, or another vendor with dashboard access) loads the media view.

Root Cause

The plugin's media controller passes attachment titles through DataTables output without applying esc_html(), esc_attr(), or wp_kses() before serialization. Server-side JSON encoding escapes quotes and slashes but does not neutralize <script> tags or HTML event handlers rendered via innerHTML on the client. The combination of missing input sanitization and missing output escaping produces the Stored XSS condition.

Attack Vector

An authenticated attacker with a Vendor account authenticates to the WordPress REST API and issues a POST request to /wp-json/wp/v2/media uploading any file while setting the title parameter to an XSS payload such as an <img> tag with an onerror handler. The record is stored with the malicious title intact. When an administrator or another privileged user opens the media dashboard, the plugin fetches the attachment list, returns the unescaped title inside a JSON payload, and the front-end DataTables initialization writes it into the table cell as HTML, triggering script execution in the victim's authenticated session.

Detection Methods for CVE-2026-12126

Indicators of Compromise

Media attachment rows in wp_posts where post_type = 'attachment' and post_title contains HTML tags, on*= event handlers, or javascript: URIs.
REST API access logs showing POST requests to /wp-json/wp/v2/media from Vendor-level accounts with unusual title parameters.
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading the WCFM media dashboard.
New or modified administrator accounts created shortly after a vendor uploaded media.

Detection Strategies

Query the WordPress database for attachment titles containing <, >, script, onerror, onload, or onclick substrings.
Review web server and WordPress access logs for /wp-json/wp/v2/media POST requests correlated with the WCFM vendor role.
Inspect browser Content Security Policy (CSP) violation reports for inline script blocks originating from /wp-admin pages tied to WCFM.

Monitoring Recommendations

Enable WordPress audit logging for attachment creation and metadata changes made through the REST API.
Alert on privileged sessions that trigger unexpected DOM script execution when navigating to WCFM admin pages.
Track the plugin version deployed across WordPress instances and flag any host still running 3.7.3 or earlier.

How to Mitigate CVE-2026-12126

Immediate Actions Required

Update the WCFM Marketplace plugin to a version newer than 3.7.3 once released by the vendor and confirmed to include the fix referenced in WordPress changeset 3588629.
Audit all existing attachment titles and sanitize or remove entries containing HTML or JavaScript payloads.
Review vendor accounts, disable any that are unused, and enforce strong authentication on the remaining accounts.

Patch Information

The fix is tracked in the WordPress plugin repository changeset 3588629 for wc-multivendor-marketplace. Refer to the Wordfence Vulnerability Report and the WordPress Changeset for the exact code modifications applied to controllers/media/wcfmmp-controller-media.php and core/class-wcfmmp-media.php.

Workarounds

Restrict REST API access to /wp-json/wp/v2/media for Vendor-level accounts using a Web Application Firewall (WAF) rule until the plugin is patched.
Temporarily disable the WCFM Marketplace plugin on production sites that cannot immediately upgrade.
Enforce a strict Content Security Policy in wp-admin that blocks inline event handlers and untrusted script execution.
Manually escape attachment titles in a mu-plugin by filtering the_title and wp_prepare_attachment_for_js outputs with esc_html().

bash

# Example WP-CLI command to identify attachments with suspicious titles
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_type='attachment' AND (post_title LIKE '%<%' OR post_title LIKE '%javascript:%' OR post_title LIKE '%on%=%');"